Agent Hooks: A Governance Contract
Where Deny Means Deny

You wrote guardrails for your agent — but the guardrails may not execute. On August 27, 2026, Microsoft's Responsible AI team published Agent Hooks, an open, framework-neutral governance contract built to turn "deny means deny" from framework-specific folklore into a testable, reproducible promise. The question it answers is blunt: when a control says no, does the action actually stop?

The incident: the guard threw, the refund still went out

The Microsoft post opens with a failure mode that should make any AI team uncomfortable. A team built a customer support agent that could look up accounts, draft replies, and issue refunds. Compliance set two rules: refunds above a threshold need human approval, and account data never reaches the reply channel unredacted. The team did what the framework docs suggested, adding a guardrail callback on tool calls and tool outputs.

During quarter-end financial closing, the team found a large gap in the discretionary refund budget. The review found three things. First, the approval guard threw an exception on a malformed refund request; the framework dispatcher caught the error, logged a warning, and executed the refund anyway — its documented default. Second, the output scanner never saw one egress path: a batch entry point emitted no callback at all; the guard was attached to the interactive path, and the batch path simply never fired it. Third, nobody could produce evidence of what either guard actually evaluated, because callbacks observed values without recording anything that binds them to what executed. Microsoft's conclusion is blunt: the team followed the instructions. The instructions were the problem.

The hooks you have are not a governance surface

The team catalogued the interception surfaces of mainstream agent frameworks from primary documentation and source. The finding is consistent: these mechanisms were designed for observability, not governance. LangChain's BaseCallbackHandler defines 20 lifecycle events, but the dispatcher discards handler return values — a callback cannot block or rewrite anything, and an exception is swallowed unless the author opts into raise_error. CrewAI's event bus registers 78 typed event kinds, all observe-only. LlamaIndex's instrumentation is telemetry by design: no return value, exception, or mutation reaches the underlying action. The OpenAI Agents SDK exposes lifecycle hooks that observe and guardrails that can block, but its input guardrails race the first model call unless you set a flag. Semantic Kernel's filters genuinely block, but when registered through dependency injection, execution order is not guaranteed — and ordering decides whether redaction runs before egress.

Count the lifecycle surfaces alone: LangChain exposes 20 callback events, CrewAI 78, the OpenAI Agents SDK seven, and Semantic Kernel three, while LlamaIndex ships two coexisting observability surfaces. Control semantics range from none to full block-and-modify. Failure behavior ranges from silently swallowed to propagated. And not one of these frameworks ships a conformance suite a controls author can run to verify that a deny stops the action. Every guarantee your control depends on is framework-specific folklore.

Agent Hooks: one contract, testable on both sides

AGENT-HOOKS-0.1, published August 27, is deliberately small: eight interception points bracketing the agent loop (agent_startup, input, pre_model_call, post_model_call, pre_tool_call, post_tool_call, output, agent_shutdown), one tiered JSON context payload (AgentContext), three verdicts (allow, deny, transform), and normative host obligations. Controls integrate against the contract once and reuse across frameworks. Frameworks implement it once. The M×N adapter matrix becomes M+N.

It ships with SDKs in Python, TypeScript, .NET, Rust, and Go, a 47-scenario conformance kit, and a first-class implementation merged into Microsoft Agent Framework's core. Installing the full contract is one factory call — deliberately impossible to install part of the contract and believe you have all of it.

Deny means deny: fail-closed is a property of the type system

The sharpest design decision sits in the verdict semantics. Earlier iterations had warn and escalate verdicts; both were deliberately removed. Warn became allow carrying warnings, because a warning is metadata, not control flow. Escalate is now modeled as a deny carrying an approval block — denied as-is unless the approval seam lifts it. An unresolved escalation used to be a state the host had to remember not to proceed on; now it is simply a deny. Fail-closed is a property of the type system, not a code path someone has to maintain.

Host obligations are normative — the half frameworks usually leave undefined. A deny at pre_tool_call means the tool is not invoked. A deny at post_tool_call means the result is discarded and never enters agent state. A host that cannot build a valid context, cannot reach an interceptor, times one out, or receives a malformed verdict must synthesize a deny with a reserved machine-readable reason. The opening incident cannot occur on a conformant host: the crashing guard becomes a deny, and the record says so.

The demo suite turns this semantics into a reproducible script: a support agent tries to refund $840 against a $500 cap, the guard escalates, a human approves, the refund executes, and the record binds the approval to that identity. Then a replay mutates the call: issue_refund for $8,400, claiming the earlier authorization. Different content, different identity — the deny stands. The same scenario runs on eight frameworks (LangGraph, the OpenAI Agents SDK, Microsoft Agent Framework, Semantic Kernel, LlamaIndex, CrewAI, the Claude Agent SDK, and a bare reference host), producing an identical 20-row decision stream.

Three actions for enterprises

For CISOs and technical leaders, the signal is clear: agents now carry tools, credentials, and autonomy into production, and the governance question has shifted from "did we write a guardrail?" to "is it enforced on every path, and can we prove it?" A contract is not a silver bullet — the host remains a trusted boundary, this is not a sandbox — but it turns a cooperating host's promises from folklore into something checkable, reproducible, and auditable.

References

• Microsoft Command Line Blog: Agent Hooks: An open, framework-neutral AI governance contract (2026-08-27) — https://commandline.microsoft.com/agent-hooks-framework-neutral-ai-governance-contract/
• Agent Hooks spec and SDKs (AGENT-HOOKS-0.1, MIT-licensed) — https://responsibleai.github.io/agent-hooks/ (repo: https://github.com/responsibleai/agent-hooks)
• Microsoft Agent Framework — https://commandline.microsoft.com/agent-framework-layered-sdk-loops-workflows-harnesses/